When I considered using an AI transcription tool in my own 0.5 Full Time Equivalent governance role, the conclusion was simple: I did not have the time to mitigate the implications. That experience reflects a wider truth across the small‑charity landscape. Whilst AI is increasingly present in charity operations for many small organisations, the practical reality is far more risk-oriented for those within governance, or as with me, with a legal background.
This article looks at AI’s opportunity through a risk and governance lens and how we make the most of it as a sector. A quote from it kindly appeared in Third Sector in an article from Zoe Amar. I have chosen to publish my fuller view here on Sharma on Governance.
Over the past five years I have worked across five charities as a governance professional, trustee and operational team member. These charities had incomes under £1m. In this context, if a charity invests in governance at all, you are the investment. There is little budget for essential tech tools, let alone AI. Couple this with a distinct lack of guidance and governance professionals in small charities are left to unpack AI’s risks and opportunities alone, using only free tools and basic functionality.
From the Charity Digital Skills Report 2026 (interim findings, first 240 responses): 88% of charities say AI tools are used in their day-to-day work, up from 76% in 2025 and 61% in 2024. Alongside this, 60% of charities now have, or are developing, an AI policy. That leaves a significant gap of at least 28%.
The risk of use of AI
The primary barrier is risk and the second is structural and both play into each other. Governance and some charity work routinely involve confidential and sensitive information- member complaints, regulatory engagement, funding concerns, safeguarding issues. Many charities also operate in environments where data protection is seen as needing to be proportional, any additional complexities AI introduces can seldom be unpacked.
AI tools introduce risks that are difficult to justify in this context:
- Ethical difficulties in the use cases presented by AI, including environmental concerns and bias and discrimination
- Potential training on uploaded data
- Hallucinations and inaccuracies, sometimes even harmful
- Assertions presented as fact
- Cloud‑based processing outside the UK
- Unclear or evolving regulatory expectations
- Data breach risk
These are not just theoretical. The National Eating Disorders Association had to suspend its chatbot after it was reported to provide harmful advice in June 2023.
I have encountered each of these in practice – that’s where the structural difficulties come in. Managing these risks requires risk assessments, policy updates, Data Protection Impact Assessment’s, staff training and ongoing monitoring. Small charities simply do not have the capacity to do this, even during scheduled policy cycles. Their structural constraints dictate what is done and what is not in this context, as it does in so many others. Add major developments such as the new Charity Governance Code 2025 (which now covers having AI policies), Statement of Recommended Practice 2026 and Code of Fundraising Practice 2025 (also expanded to cover AI usage in fundraising) already demanding attention, AI exploration falls to the bottom of the list. Or worse, happens unmitigated.
This usage of AI, without Board oversight or proper controls, carries the most risk – and the data supports it is happening. Research from the Charity Excellence Framework found fewer than one in four charities have approved AI tools, policies, or training in place, yet adoption has surged.
For small charities holding sensitive beneficiary data – health information, safeguarding records, financial hardship details – this is not a theoretical risk. It is a live data protection exposure that most may only discover when something goes wrong. The question for trustees is not whether their organisation is using AI. It is whether they know how. That is a critical governance gap.
Where AI Can Help Today
Given these constraints, the realistic opportunities lie in low‑risk, non‑sensitive, supplementary tasks without personal data usage, such as:
- Researching unfamiliar topics (with verification against primary sources)
- Drafting frameworks or templates
- Sense‑checking ideas before consulting official guidance
- Light administrative support
This is the “low‑hanging fruit” that small charities can safely access without significant investment or risk exposure. It is not transformative, but it is practical. However, the sector talks about the power of small. Is consigning smaller charities to low-hanging fruit consistent with that?
What the Sector Must Do Next
To unlock AI’s potential for small charities, the sector needs to close the gap between ambition and capacity. Three things are essential:
1. Data literacy and practical guidance
Charities need resources that can be quickly translated into board papers, privacy notices and operational processes. These must be accessible, actionable and grounded in real use cases – not abstract principles.
2. Safe, low‑entry‑point tools and examples
Small charities cannot afford to experiment with tools that introduce risk or require complex implementation. They need clear, directly applicable offerings with safeguards built in as standard.
3. Leadership and partnership across the sector
Larger charities, infrastructure bodies and sector leaders must help shape and endorse approaches that smaller organisations can adopt confidently. Without this, learning will not trickle down quickly enough to be as impactful as small charities need it to be given the constraints they are under. That is not equitable. Nor is it acceptable that small charities are closing under resource pressure while AI, a technology that could create exactly the efficiencies they need, remains out of their reach.
Critically, the Charity Commission has published only a single blog post on AI – in April 2024 – and has since indicated it does not intend to produce specific guidance, leaving trustees to navigate a fast-moving landscape using existing duty frameworks alone. That is a significant gap that grows as AI capability does. Most charities would be well placed to start with Charity Digital and Charity Excellence to build their understanding and resources in this context.
A Realistic Path Forward
For AI to be genuinely usable in small‑charities, it must be accessible, safe and immediately useful. Anything that requires significant time, risk‑taking or upskilling will simply not be adopted. When tools demonstrate clear dividends – time saved, improved clarity, better starting points – small charities will lean in. Until then, AI usage may continue unboundaried, unmitigated and under-utilised with many small charities suffering because of it.
Starting to consider these risks and need a template to help? See Sharma On Governance’s risk management policy and risk register template.
Leave a Reply